This paper considers signals from the cardiovascular system for possible use in biometric authentication. The signals of particular interest here derive from photoplethysmography (PPG), which refers to the use of illumination-based sensors that are sensitive to volumetric changes as blood travels through the body. Photoplethysmography sensors have been developed for the fingertip and the ear lobe, and they provide a convenient, noninvasive means of measuring the heart rate and heart-rate variability. We demonstrate in this paper that PPG-based signals also have the potential to be used for biometric authentication, even though PPG signals appear to convey much less information than their electromagnetic couterparts, electrocardiograms (ECG). Through a novel decomposition into a sum-of-Gaussians representation, we present experimental results that indicate rank-1 accuracies of 90% and 95% with 2 seconds and 8 seconds of PPG test signal data, respectively. To our knowledge, this paper is the first to demonstrate robust PPG-based authentication for subjects with different emotional states.